Banks in several former Soviet states were hit with a wave of debit card fraud earlier this year that netted millions of dollars worth of cash. These bank heists relied on a combination of fraudulent bank accounts and hacking to turn nearly empty bank accounts into cash-generating machines. In a report being released by Trustwave's SpiderLabs today, SpiderLabs researchers detailed the crime spree: hackers gained access to bank systems and manipulated the overdraft protection on accounts set up by proxies and then used automated teller machines in other countries to withdraw thousands of dollars via empty or nearly empty accounts.

While SpiderLabs' investigation accounted for about $40 million in fraudulent withdrawals, the report's authors noted, "when taking into account the undiscovered or uninvestigated attacks along with investigations undertaken by internal groups or third parties, we estimate losses to be in the hundreds of millions in USD." This criminal enterprise was a hybrid of traditional credit fraud and hacking. It relied on an army of individuals with fake identity documents, as these folks were paid to set up accounts at the targeted institutions with the lowest possible deposit. From there, individuals requested debit cards for the accounts, which were forwarded to co-conspirators in other countries throughout Europe and in Russia.

Meanwhile, a phishing campaign was used by the attackers to implant remote access malware on bank employees' computers. The attackers used these backdoors to gain broader access to the banks' networks, breaking into multiple systems at each bank. The attackers then targeted a third-party payment processing provider, using banks' virtual private network credentials with the processor to gain access to their network. This allowed attackers to drop multiple malicious software packages onto the processor's network. "Key amongst them was a legitimate monitoring tool installed on the processor’s Terminal Server," SpiderLabs investigators reported. "That allowed users to access the card management application via a browser."

The monitoring software, called "Mipko,” is marketed as an "employee monitor." It allowed the attackers to gather up nearly four gigabytes of data from the processor's networks, including screenshots, keyboard entries, and other data (including login credentials) for all of the users who had accessed the card management system. Using this information, the attackers identified the card management applications used by the targeted banks and then logged into them using stolen credentials in order to change overdraft protection settings on the fraudulent accounts. Within moments of the changes, attackers coordinated withdrawals from the accounts using foreign ATMs connected to the payment processor.

The very limited use of actual malware and use of the banks' own networks to access the card management systems made the attack difficult to detect, as did the use of Windows and PowerShell commands to move within the network. There was little if any data exfiltrated from the banks themselves, as the attackers "adopted the emerging tactic sometimes called 'living off the land'," the investigators reported.

The "malicious" software that attackers did employ included plink.exe— a Windows SSH client—which they used to access RDP sessions to Windows Terminal Server over SSH tunnels. In addition to the Mipko Employee Monitor, the attackers also used a tool created for penetration testing—Cobalt Strike Beacon—”mainly used to maintain backdoor connection with an endpoint geolocated in the United States of America," the SpiderLabs researchers wrote.

While the cases detected so far have been restricted to banks in Eastern European states (including Russia), SpiderLabs researchers warned that the tactics could soon be taken worldwide. "In cybercrime, this area is often the canary in the mineshaft for upcoming threats to other parts of the world," the report authors stated.